Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 03:34

General

  • Target

    e66afb18b6cd47d95db7b148a77bcdb275381b1458dc3830d6c41bc7b237346c.exe

  • Size

    816KB

  • MD5

    f652ac403884b6957938a064dc2d3e3f

  • SHA1

    e4d56cabb44e5583650d3cac1d214cde1629f82e

  • SHA256

    e66afb18b6cd47d95db7b148a77bcdb275381b1458dc3830d6c41bc7b237346c

  • SHA512

    6b283035cc4a8d4ef0475cbd6760e02d8651927daa198269e334cd62cc35a8d1ce54332502a0be09cee27621815cf6a26c25ef4a7193e269f5488384ba18db22

  • SSDEEP

    12288:SmwRwrKd7O4i0RfzjfL9deeUcviQG3juMU3kPK2:SbSKFO49Rfzjj9deHSG3xyb

Malware Config

Signatures

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e66afb18b6cd47d95db7b148a77bcdb275381b1458dc3830d6c41bc7b237346c.exe
    "C:\Users\Admin\AppData\Local\Temp\e66afb18b6cd47d95db7b148a77bcdb275381b1458dc3830d6c41bc7b237346c.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Users\Admin\AppData\Local\Temp\e66afb18b6cd47d95db7b148a77bcdb275381b1458dc3830d6c41bc7b237346cSrv.exe
      C:\Users\Admin\AppData\Local\Temp\e66afb18b6cd47d95db7b148a77bcdb275381b1458dc3830d6c41bc7b237346cSrv.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Program Files (x86)\Microsoft\DesktopLayer.exe
        "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2224
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d17108c34ba9520ac1afdbf00418d01f

    SHA1

    eb52a3fc9f9b888b26029ee30f5b76f38ca60d06

    SHA256

    0ad0ff284e92f4a18c65f05f889c969c127d3eb1a565ba7909a811ae5e00e3a6

    SHA512

    65f5d04277ae2aeff4df7124472bcc47053161a058062cdd8dd2fcd173f434241066a45bc0062fa6561434702d46301a976ad83979289d9f6843db640ec80fb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f7c9eef513be72f624d7505ab2cd75b7

    SHA1

    6abad5acdb14344eae6bdaa524fb463333e39903

    SHA256

    9fe42ec41161355cf60ed9e2fd1c00957cb90d0a0a90666c9790444382ce00ce

    SHA512

    b1cf25c4989c7cc7ed1a0c622f35a5fb4d43bac8da5ae3400af0449bccc63b43dc2cf4b8df228e00894edf2cb26bab25dd1d3d838637c8a0a6781c8739349ae0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a42cd030b7a5818b5d17a6864ae77881

    SHA1

    d6468816d57ea600140c0beb94706af911da9cf0

    SHA256

    0926309efed94265a5d0784e2fbb02ee175dd3eff389f17cd62c1b6b0680ffe5

    SHA512

    b6a0e456326298f6017699bc96ebaee6e7ba0f6357e52d4047ae35d58555beef29d17f63abd00ec1541787116e51afe6ebce986ac1d1c8fad49f3bd1b3f884b2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    58e8dc0ce63de81649744db06efff4d4

    SHA1

    2d333296089fb9ffda1ca6facc78a786415e0c3b

    SHA256

    6c95d9d5edfb31dcfe71c4bffe1fbff8656fb8825d7a5409be1411f6fb5fa0b9

    SHA512

    974d74f108e359dddb9581981f75cdebc130f894ce0e491b7044c9f88001ab3d6143e7772bd7f61ac514113d2e9eff63a1f6f2cd71e3cc7c6271c135b1727346

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e4e48ab9c6892935364c285373545bfc

    SHA1

    47e32c3a49739e5e82c98234586e55b9fe6d1575

    SHA256

    86ecaf480953306a45a603abc21460f308d426cd3f8697e89e779898b8122823

    SHA512

    2407ce59d05ec263d965aba2b8f6eced40c1ddd45d1059f3dd7c3aaaf237c89bd80f76a2d3cc57f9d2b12a3dab77aa65562f973e4ae560d8ea1c7501ff4bea1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ea19331c5bd37bd6338849e95e01c5ea

    SHA1

    f4eb655efc4e48de23b3cd06a6ad9b757b1896b3

    SHA256

    8a7e3b51a29aaec2c98642d916f1af15c57efb0752d540b154808970462b39e4

    SHA512

    8d3b51adafd949b52f4813b962aca7c6fb709a6d6ab2686cb7f05bc2bafab69624e08ffcb1aad52f8a3a1940d260f8ba81c2f53361c6aac7971e9f55b1247152

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    69a9ff4899abe940b9870aa2046b752d

    SHA1

    cb14acf7f97ee19fef68e3c8bbb31175b3c970d8

    SHA256

    1ee92645ffc80af4ac74066dcd25c5590f7a720aac53c5f671c3b71349354eaf

    SHA512

    11caaaf1bfbd494c8c36e5f33e5a4329a6fd60c7d20c216920cfd6303c12d9a502de5cbda2e072303f3e724b6d43a7e4ed98702d1370827e3a5e14cc14bec7b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7d0d45a8f809f4da73e946443846f8bc

    SHA1

    c71c41cd2df10db08e2a3b5255a5fc715ef7e34c

    SHA256

    1e44236185f13de9e3a2beb090ed74b14a5a15d883d6f228aa20a3bb13c76c61

    SHA512

    ef64731a168fd5aa18a32481f45a201efe4ac357d9cf3aa2744a1bb98e05a40d9deacfd4a6d9258d3e0337b9ecffa9f62c1d6f82de348c3a765d8d2114984413

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    057b21531db2b744e9bc600eb6fb3662

    SHA1

    ab36938bc91460acb459e816ec6704c68895fb02

    SHA256

    1144ab003c2c7a7133137fa2cda65de5d2f80c2d3e3eaee213481b925d378e3d

    SHA512

    34bb98b0e560fff7adfa2e8f6d2a6a8ca6f67da71beb371d63881e6ea71c84323994be8c74286983830968f9023b6d4e22ccd8f503e811dd8a40252ded42392b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7b629bb78497f69c023cd51970a31cf5

    SHA1

    64f12d6a6c4473c85a551a3db0d32d736f051e72

    SHA256

    513e1ea6a433875ae2d5c1bad5903c82bf200ce5957922a26516c9141ae44965

    SHA512

    11bf601755aeabcd1336de732d5cbb770870d5139842f2313964fb248c1724e824ac726a504f649650dc69a8a0461133638a8767fdba1e588021515a67ff2694

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bb1de2ed4d3bcf3524ab4323f3d96487

    SHA1

    f87c6d5570610d8e6f68dcb10b490e2584e7b023

    SHA256

    cfc469cdb3353a2553b3383f42422dad047a48fc59365c4c200bca1102a7bd05

    SHA512

    78a737d70e7e8be7a77f68ba66a3078b0996adf95cd5952e8827bb56f742b4239427a729d7eb5888bf4b6bad56a1358ec211a6a6be2955a59cbdfa0cd60c0dac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    04e4de6a5d8b3963ff4c3babc3546993

    SHA1

    f061db4eb46e1321672f4ce60b826f22ebc0f254

    SHA256

    38f00517183d10b28b7f994ab728cb24f52c6bc4a64a81fd3d7d9c4fa580e380

    SHA512

    45ceca4609b630abf57bf0edb49571b9e0f480d6fffb5dbce31cd0976ca9d148b0d57cdd0bd7fe512ad57b3f4c4aa1a24add875e69dd7f7139c76ae105e039e1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b1593d60b78accba355ebf77527a171a

    SHA1

    b46000b254df9784162ba7c701684141b56760e3

    SHA256

    db66c6cfdf45bba3984651ea1b541a12c6bc7a1593658a5e95150ec25649636d

    SHA512

    7b6b336a2c9a3c949340e59031937496db896d261b34249d8d26c03d3f94d5539ec8857ea17a7978423a65235ace3c030dad97d8798360622dca605283f76c02

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86998dbbd333ed0a2ac47687987a2394

    SHA1

    e34b58368b0d9d02f505df749e6d873fb7a5dfa3

    SHA256

    dba9a5890543e2a8d9dd586e63265f7e10387f24aae0980fa8e12ea756b7803b

    SHA512

    fe18fd40ecea1deb677d89c39abe2541c4ff26ea908de1ae6cbf3afa7aea4104e8d93adca706ddf34b72dc7c2477f75709bbb570dd6b53b77509658f64769c1f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8485d77c38740da95a530e4e0ca9f1fa

    SHA1

    36c80f1122277aee26313490e49eb54543d4f3d2

    SHA256

    08890cac37ea3724d32f5d3df95fe7f474cf29c023779b38f00462a3c2c32acd

    SHA512

    f4934c84b254d5c41469bed33e6fc3423f4d9754304adb5ab2c46cbb57d6e9647a2dde7750b6103adcb4c7ce3a9896568ab43e7d39c2bc412cc1b45598dc84d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    07556428baf243133c47e0909db198cb

    SHA1

    2dcb83485894a7d0c46bd7956cbd3f5f9cfd649c

    SHA256

    82563aad567a8e755c56a236f21c8dd3d19dc49e07b0fdae0a71efea32bb86fd

    SHA512

    de87c349b18afcf0043470c1789c6622a34c771e62ff46d3eef4514af999da962ed7ca7fde1e730f16ff018bb998f073aae5c240f13e1476dc1e0d3ce91a9259

  • C:\Users\Admin\AppData\Local\Temp\Cab8F57.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar8F6A.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\e66afb18b6cd47d95db7b148a77bcdb275381b1458dc3830d6c41bc7b237346cSrv.exe

    Filesize

    55KB

    MD5

    ff5e1f27193ce51eec318714ef038bef

    SHA1

    b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

    SHA256

    fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

    SHA512

    c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

  • memory/1908-450-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1908-451-0x00000000002F0000-0x000000000031E000-memory.dmp

    Filesize

    184KB

  • memory/1908-1-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1908-8-0x00000000002F0000-0x000000000031E000-memory.dmp

    Filesize

    184KB

  • memory/1976-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2224-19-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2224-17-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2224-15-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB